Headers Live Autor: Libor Benes (Dr. B)

See what your browser is actually sending and receiving — as it happens, right in the sidebar, drawn from a bundled reference table, not a network proxy or an external lookup service.

Watch live request and response headers as you browse: click any request to see its full Request and Response headers, color-coded by category — red for outgoing, cyan for incoming, and further tinted by type (security, authentication/cookies, CORS, caching, identity/routing). Hover any header name for an explanation, and where it matters, a note on what goes wrong if that header is missing or misconfigured — from Content-Security-Policy to Set-Cookie to Access-Control-Allow-Origin.

Built for anyone who wants to see what's actually happening on the wire without digging through DevTools — web developers debugging CORS and caching issues, security-minded users checking a site's header hygiene, IT staff triaging live issues, and students learning how HTTP really works.

🏛 About Headers Live:
- Every page load fires off dozens of requests carrying headers most people never see — caching directives, auth tokens, CORS policy, security posture.
- Headers Live surfaces all of it live, in one sidebar, color-coded and searchable, without leaving the page you're on.

📐 Desktop Sidebar Design:
🗂 Capture Toggle: All Tabs (cumulative, survives tab switches) or This Tab (resets on navigation).
🧾 View Toggle: List (one line — method, status, type, domain) or Full Details (every header, always expanded).
🔎 Type & URL Filters: Narrow by resource type or a keyword in the URL.
🧮 Header Picker: Show and export just the headers you want — Referer only, or Content-Type + Host + Set-Cookie, or all of them.
📋 Copy Buttons: Copy any single header or an entire section to the clipboard.
📤 Structured CSV Export: One click, uniquely named and timestamped. Excellent output formatting integration with Excel.

⚙ How It Works — Observed, Never Sent Anywhere:
• Headers Live uses Firefox's read-only webRequest listeners to observe headers already leaving and arriving at your browser; it never initiates, modifies, or redirects any request.
• All 39 curated header descriptions are bundled as static, hand-authored reference data — nothing is fetched or looked up externally.
• Filtering and rendering happen entirely client-side.
• Every row and label is built with safe, text-only DOM methods — nothing is ever inserted as HTML.

📚 Header Coverage:
There's no single canonical list of "the headers that matter." Headers Live's built-in reference covers 39 of the ones you'll actually meet — content negotiation, caching, identity/routing, authentication and session, CORS, and browser-facing security headers — with 19 of those flagged as security-relevant and isolatable with one toggle. The header picker offers 30 as quick checkboxes; anything outside that list is still captured and exported in full, just without a tooltip.

📊 What You See:
📇 Entry Row: Method, status, type, and domain per captured request.
🔽 Full Detail Row: The same entry expanded to every header, colored by category.
🔎 Live Count: Matching requests out of the total captured this session.

🖥 Features:
🔴🔵 Request/Response Color Coding — Always know which side of the wire you're reading.
🎨 Per-Header Category Coloring — Security, auth/cookie, CORS, caching, and identity headers each get their own accent.
🗂 Per-Tab or Cumulative Capture — A running cross-tab log, or just the active tab.
🧮 Header Scope Picker — See and export only what you need.
📋 One-Click Copy — Single headers or whole sections.
📤 Structured, Timestamped CSV Export — Never overwrites a previous export.
🪶 Zero Outbound Network Footprint — The extension itself never contacts any server.

🎯 Perfect for:
• Web developers debugging caching, CORS, redirects, or auth headers.
• Security-minded users checking a site's header hygiene at a glance.
• IT support staff triaging header issues live.
• Students learning how HTTP requests and responses actually work.

🔒 Security-First Architecture:
✅ No Data Collection — Explicitly declared in manifest.json.
✅ No Telemetry — No analytics, no tracking, no third-party requests.
✅ No eval() or innerHTML — Safe, text-only DOM methods throughout.
✅ Local-Only Storage — Only UI preferences are saved locally; captured headers stay in memory and are never transmitted.
✅ Read-Only Network Observation — webRequest listeners are non-blocking; Headers Live can watch but never alter a request.
✅ Permissions Matched to Function — webRequest and host access to observe headers, storage for local preferences, clipboardWrite for the Copy buttons — nothing more.

🛠 Technical Details:
• Compatibility: Firefox 140.0+ Desktop only.
• Runtime Execution RAM Footprint: ~40 KB (core scripts: manifest.json + sidebar.html + sidebar.js + background.js).
• Total Extension Download/Install Size: ~94 KB (including README.md).
• Compressed Folder (.zip): ~28 KB.
• Entry point: sidebar_action panel (sidebar.html).
• Network requests: None initiated by the extension.
• Storage: browser.storage.local, for UI preferences only.
• Permissions requested: webRequest, storage, clipboardWrite, host permission for all URLs.
• Data Collection: None (explicitly declared).

⚠ Limitations:
📚 Curated, Not Exhaustive — 39 headers have full descriptions; others are still captured and exported, just without a tooltip.
🖥 Desktop Only — Firefox sidebars are not available on Android.
🌐 Observes, Doesn't Modify — Read-only by design; cannot rewrite, block, or inject headers.
💾 Session-Scoped Capture — Export to CSV before closing the window if you want to keep a log.

⚠ Legal Disclaimer:
Headers Live is an independent browser extension developed for informational, research, testing, and debugging purposes. It is not affiliated with, endorsed by, sponsored by, or in any way officially connected to Mozilla Corporation, Firefox, or any other entity or brand mentioned within the extension.